InfoSecBulletin Cybersecurity for mankind
Qualcomm has unveiled its May 2026 Security Bulletin, revealing serious flaws with its software and hardware. The bulletin points out several Critical issues that could let unauthorized users access and damage memory on millions of devices using Qualcomm chipsets.
The company is sharing updates with Original Equipment Manufacturers (OEMs) and has advised them to install these updates on released devices as soon as they can.
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
The biggest flaw fixed this month is CVE-2026-25254, which has a CVSS score of 9.8. Discovered in the Qualcomm Software Center, this “Critical” flaw relates to wrong permissions in the SocketIO interface.
Vulnerability Type: Improper Authorization (CWE-285).
Impact: This flaw leads directly to Remote Code Execution (RCE).
Access Vector: Remote.
Affected Versions: QSC v1.17.1, v1.19.1, and v1.21.0.
An attacker could use this interface to run harmful commands without being near the device.
Another critical flaw resides at the very foundation of device security: the Primary Bootloader. Tracked as CVE-2026-25262, this “Write-what-where” condition occurs while the system processes a crafted ELF (Executable and Linkable Format) file.
While this attack needs local access, it causes serious memory damage that threatens boot integrity. This problem impacts various old and special chipsets, like the MSM8909, MSM8916, and SDX50.
Qualcomm also fixed a serious problem in its PLC (Power Line Communication) Firmware, known as CVE-2026-25293. This issue has a CVSS score of 9.6 and is due to wrong authorization that causes a buffer overflow. Like the Software Center issue, this flaw can be accessed from afar and affects the QCA7005 chipset. The risk is greater because the exploit can bypass security and affect the whole system.
Qualcomm makes the technology for many smartphone and IoT makers, so users can’t fix these problems themselves. You have to wait for your device maker (OEM) to give a system update.
